@team-semicolon/semicolony-cli 4.18.52 → 4.18.53
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
-- 163_workspace_projection_grants_sc_app_read.sql
|
|
2
|
+
-- Allow the least-privilege Gateway role to resolve exact Worker projection
|
|
3
|
+
-- grants during Bearer authentication.
|
|
4
|
+
--
|
|
5
|
+
-- Safety:
|
|
6
|
+
-- - Requires 135_sc_roles and 161_workspace_projection_grants.
|
|
7
|
+
-- - Grants read-only access to sc_app.
|
|
8
|
+
-- - Explicitly removes projection writes and provider/public access.
|
|
9
|
+
-- - Stores or exposes no projected credential value.
|
|
10
|
+
|
|
11
|
+
GRANT USAGE ON SCHEMA semicolony TO sc_app;
|
|
12
|
+
|
|
13
|
+
REVOKE ALL PRIVILEGES
|
|
14
|
+
ON TABLE semicolony.workspace_projection_grants
|
|
15
|
+
FROM PUBLIC, sc_provider;
|
|
16
|
+
|
|
17
|
+
REVOKE INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER
|
|
18
|
+
ON TABLE semicolony.workspace_projection_grants
|
|
19
|
+
FROM sc_app;
|
|
20
|
+
|
|
21
|
+
GRANT SELECT ON TABLE semicolony.workspace_projection_grants TO sc_app;
|